diff options
| author | Jo-Philipp Wich <jow@openwrt.org> | 2011-09-01 20:37:22 +0000 |
|---|---|---|
| committer | Jo-Philipp Wich <jow@openwrt.org> | 2011-09-01 20:37:22 +0000 |
| commit | 995face56d5d8f701a505dd2ed9d827a69384675 (patch) | |
| tree | b6846ca303d2a712137fbd1ad8bb1f83703273b2 /package/firewall/files | |
| parent | 99e422472c4279c5a79faaa8a587b1ca33d04a5e (diff) | |
| download | upstream-995face56d5d8f701a505dd2ed9d827a69384675.tar.gz upstream-995face56d5d8f701a505dd2ed9d827a69384675.tar.bz2 upstream-995face56d5d8f701a505dd2ed9d827a69384675.zip | |
firewall: make ESTABLISHED,RELATED rules match before INVALID, use conntrack instead of state match (#10038)
SVN-Revision: 28148
Diffstat (limited to 'package/firewall/files')
| -rw-r--r-- | package/firewall/files/lib/core_init.sh | 16 |
1 files changed, 8 insertions, 8 deletions
diff --git a/package/firewall/files/lib/core_init.sh b/package/firewall/files/lib/core_init.sh index 185fffb98b..f2cde1c470 100644 --- a/package/firewall/files/lib/core_init.sh +++ b/package/firewall/files/lib/core_init.sh @@ -1,4 +1,4 @@ -# Copyright (C) 2009-2010 OpenWrt.org +# Copyright (C) 2009-2011 OpenWrt.org # Copyright (C) 2008 John Crispin <blogic@openwrt.org> FW_INITIALIZED= @@ -66,17 +66,17 @@ fw_load_defaults() { done fw_sysctl_interface all + fw add i f INPUT ACCEPT { -m conntrack --ctstate RELATED,ESTABLISHED } + fw add i f OUTPUT ACCEPT { -m conntrack --ctstate RELATED,ESTABLISHED } + fw add i f FORWARD ACCEPT { -m conntrack --ctstate RELATED,ESTABLISHED } + [ $defaults_drop_invalid == 1 ] && { - fw add i f INPUT DROP { -m state --state INVALID } - fw add i f OUTPUT DROP { -m state --state INVALID } - fw add i f FORWARD DROP { -m state --state INVALID } + fw add i f INPUT DROP { -m conntrack --ctstate INVALID } + fw add i f OUTPUT DROP { -m conntrack --ctstate INVALID } + fw add i f FORWARD DROP { -m conntrack --ctstate INVALID } FW_NOTRACK_DISABLED=1 } - fw add i f INPUT ACCEPT { -m state --state RELATED,ESTABLISHED } - fw add i f OUTPUT ACCEPT { -m state --state RELATED,ESTABLISHED } - fw add i f FORWARD ACCEPT { -m state --state RELATED,ESTABLISHED } - fw add i f INPUT ACCEPT { -i lo } fw add i f OUTPUT ACCEPT { -o lo } |